Privacy Policy

Here you can read what personal data GoalCube processes about you, why, for how long and who sees it. Data that our customers put into GoalCube is processed by us on the customer's behalf under the data processing agreement.

Effective from 1 November 2026 · version 2026-10-11

This translation is provided for your convenience. Only the Danish version is legally binding. Read the Danish version

Who is the controller?

Goalcube ApS, company registration (CVR) no. 44709805, Ahlmannsvej 19, st., 6400 Sønderborg, Danmark is the controller for the personal data described here. You can always write to us at contact@goalcube.eu.

Data in the GoalCube system. When a company uses GoalCube and puts in data about, for example, employees, applicants or customers, the company is the controller and GoalCube is the processor. This is described in the data processing agreement. If you have questions about that data, contact the company that uses GoalCube.

When you visit goalcube.eu

No cookies and no third-party tracking. Fonts, images and scripts are loaded from our own server. Read the cookie policy.
Visitor statistics without cookies. We count visits with Umami, which we run ourselves in the EU. Umami sets no cookies, stores nothing on your device and does not store your IP address. We see, for example, which pages are read, browser and screen size, and which country and city the visit comes from – not who you are. A visit is recognised only on the same day. Legal basis: our legitimate interest in improving the site (Article 6(1)(f) GDPR). If your browser has "Do Not Track" switched on, we do not count you.
Technical logs. Our hosting provider Clever Cloud in France records technical information such as IP address and time in its operational logs in order to run and protect the site. Legal basis: legitimate interest (Article 6(1)(f)).

What	Details
Data	Your email address and whatever you choose to provide: company, country, number of users, interests and which AI you use. We also store the time and the text you agreed to.
Purpose	To write to you about the waitlist and the launch of GoalCube.
Legal basis	Your consent (Article 6(1)(a) GDPR). You can withdraw it at any time.
How long	Until you withdraw your consent, and no longer than 12 months after the launch. If you become a customer, the section on customers applies.
Who sees it	GoalCube and our hosting provider in the EU. If we send emails about the launch, they are sent via Brevo in the EU.

When your company is a customer

What	Details
Data	Name, email address, role and passkeys of contact persons and users; the company's name, CVR number, address, subscription, payments and invoices; and what users do in the system (audit log).
Purpose	To provide GoalCube, give access, send messages from the system, invoice and document decisions.
Legal basis	The agreement with your company and our legitimate interest in being able to contact its employees (Article 6(1)(b) and (f)), and the Danish Bookkeeping Act (bogføringsloven) for accounting records (Article 6(1)(c)).
How long	For as long as the agreement runs, and then no longer than 30 days. Accounting records are kept for 5 years after the end of the financial year, as the Danish Bookkeeping Act requires.
Who sees it	GoalCube and our sub-processors, see below.

When you write to us by email

What	Details
Data	Your email address, your name and what you write.
Purpose	To reply to you. Questions about the system are answered by our AI assistant; legal matters, complaints, payment, press, partnerships and requests concerning your rights are answered by a human. You can always write "human".
How we use AI	Before the AI assistant writes a draft, we automatically replace, in the EU, names, email addresses, phone, ID and account numbers and company names in your email with codes. Names are detected using name lists and patterns, so a rare name may exceptionally slip through. Only the pseudonymised text is sent to Anthropic (Claude) in the USA. The real values are put back in at our end before the reply is sent. No decisions about you are made automatically.
Legal basis	Our legitimate interest in replying to enquiries (Article 6(1)(f)), and the agreement if you are a customer (point (b)).
How long	24 months; after that the email is deleted automatically. If you ask us to, we delete it sooner.
Who sees it	GoalCube, Clever Cloud, Brevo (receives and sends emails in the EU) and Anthropic (pseudonymised text only).

We never sell personal data and do not use it for advertising or to train AI models. These suppliers process personal data for us under a data processing agreement:

Sub-processor	What they do	Where
Clever Cloud SAS SIREN 524 172 699, Nantes, France	Hosting GoalCube: servers and storage of all customer data.	France (EU)
Brevo SAS RCS Paris 498 019 298, 106 boulevard Haussmann, 75008 Paris, France	Sending and receiving emails, e.g. replies to enquiries sent to GoalCube and messages from the system.	EU (Brevo states that all its servers are in the EU)
Anthropic USA (the Anthropic entity GoalCube has a contract with)	Drafts replies to emails sent to GoalCube. Receives only pseudonymised text: names, emails, phone, ID and account numbers and company names are automatically replaced with codes in the EU before the text is sent.	USA Transfer mechanism: EU standard contractual clauses (modules 2 and 3) in Anthropic's data processing agreement

Transfers outside the EU

Personal data is sent outside the EU/EEA in one case only: pseudonymised text from emails to us is sent to Anthropic in the USA on the basis of the EU standard contractual clauses (Article 46 GDPR). Names, email addresses and numbers stay in the EU.

Your rights

You have the right to access the personal data we hold about you and to have it rectified or erased. You can also request restriction of processing, object to processing based on legitimate interest, receive your personal data in a commonly used format (data portability) and withdraw consent. Write to contact@goalcube.eu; we reply within one month at the latest.

If you are not satisfied, you can lodge a complaint with the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark.

Changes

We update this policy when we change how we process personal data. The current version is always available here, with its date.